// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "ipc/attachment_broker_unprivileged_mac.h"

#include <mach/mach.h>

#include "base/mac/scoped_mach_port.h"
#include "base/process/process.h"
#include "ipc/attachment_broker_messages.h"
#include "ipc/brokerable_attachment.h"
#include "ipc/ipc_sender.h"
#include "ipc/mach_port_attachment_mac.h"

namespace {

// Struct for receiving a complex message.
struct MachReceiveComplexMessage {
    mach_msg_header_t header;
    mach_msg_body_t body;
    mach_msg_port_descriptor_t data;
    mach_msg_trailer_t trailer;
};

// Receives a Mach port from |port_to_listen_on|, which should have exactly one
// queued message. Returns |MACH_PORT_NULL| on any error.
base::mac::ScopedMachSendRight ReceiveMachPort(mach_port_t port_to_listen_on)
{
    MachReceiveComplexMessage recv_msg;
    mach_msg_header_t* recv_hdr = &recv_msg.header;
    recv_hdr->msgh_local_port = port_to_listen_on;
    recv_hdr->msgh_size = sizeof(recv_msg);

    kern_return_t kr = mach_msg(recv_hdr, MACH_RCV_MSG | MACH_RCV_TIMEOUT, 0,
        recv_hdr->msgh_size, port_to_listen_on, 0, MACH_PORT_NULL);
    if (kr != KERN_SUCCESS)
        return base::mac::ScopedMachSendRight(MACH_PORT_NULL);
    if (recv_msg.header.msgh_id != 0)
        return base::mac::ScopedMachSendRight(MACH_PORT_NULL);
    return base::mac::ScopedMachSendRight(recv_msg.data.name);
}

} // namespace

namespace IPC {

AttachmentBrokerUnprivilegedMac::AttachmentBrokerUnprivilegedMac() { }

AttachmentBrokerUnprivilegedMac::~AttachmentBrokerUnprivilegedMac() { }

bool AttachmentBrokerUnprivilegedMac::SendAttachmentToProcess(
    const scoped_refptr<IPC::BrokerableAttachment>& attachment,
    base::ProcessId destination_process)
{
    switch (attachment->GetBrokerableType()) {
    case BrokerableAttachment::MACH_PORT: {
        internal::MachPortAttachmentMac* mach_port_attachment = static_cast<internal::MachPortAttachmentMac*>(attachment.get());
        internal::MachPortAttachmentMac::WireFormat format = mach_port_attachment->GetWireFormat(destination_process);
        bool success = get_sender()->Send(new AttachmentBrokerMsg_DuplicateMachPort(format));
        if (success)
            mach_port_attachment->reset_mach_port_ownership();
        return success;
    }
    default:
        NOTREACHED();
        return false;
    }
    return false;
}

bool AttachmentBrokerUnprivilegedMac::OnMessageReceived(const Message& msg)
{
    bool handled = true;
    IPC_BEGIN_MESSAGE_MAP(AttachmentBrokerUnprivilegedMac, msg)
    IPC_MESSAGE_HANDLER(AttachmentBrokerMsg_MachPortHasBeenDuplicated,
        OnMachPortHasBeenDuplicated)
    IPC_MESSAGE_UNHANDLED(handled = false)
    IPC_END_MESSAGE_MAP()
    return handled;
}

void AttachmentBrokerUnprivilegedMac::OnMachPortHasBeenDuplicated(
    const IPC::internal::MachPortAttachmentMac::WireFormat& wire_format)
{
    // The IPC message was intended for a different process. Ignore it.
    if (wire_format.destination_process != base::Process::Current().Pid()) {
        // If everything is functioning correctly, this path should not be taken.
        // However, it's still important to validate all fields of the IPC message.
        LogError(WRONG_DESTINATION);
        return;
    }

    base::mac::ScopedMachReceiveRight message_port(wire_format.mach_port);
    base::mac::ScopedMachSendRight memory_object(
        ReceiveMachPort(message_port.get()));

    LogError(memory_object.get() == MACH_PORT_NULL ? ERR_RECEIVE_MACH_MESSAGE
                                                   : SUCCESS);

    IPC::internal::MachPortAttachmentMac::WireFormat translated_wire_format(
        memory_object.release(), wire_format.destination_process,
        wire_format.attachment_id);

    scoped_refptr<BrokerableAttachment> attachment(
        new IPC::internal::MachPortAttachmentMac(translated_wire_format));
    HandleReceivedAttachment(attachment);
}

} // namespace IPC
